Improving SIEM for Critical SCADA Water Infrastructures Using Machine Learning

Abstract

Network Control Systems (NAC) have been used in many industrial processes. They aim to reduce the human factor burden and efficiently handle the complex process and communication of those systems. Supervisory control and data acquisition (SCADA) systems are used in industrial, infrastructure and facility processes (e.g. manufacturing, fabrication, oil and water pipelines, building ventilation, etc.) Like other Internet of Things (IoT) implementations, SCADA systems are vulnerable to cyber-attacks, therefore, a robust anomaly detection is a major requirement. However, having an accurate anomaly detection system is not an easy task, due to the difficulty to differentiate between cyber-attacks and system internal failures (e.g. hardware failures). In this paper, we present a model that detects anomaly events in a water system controlled by SCADA. Six Machine Learning techniques have been used in building and evaluating the model. The model classifies different anomaly events including hardware failures (e.g. sensor failures), sabotage and cyber-attacks (e.g. DoS and Spoofing). Unlike other detection systems, our proposed work focuses on notifying the operator when an anomaly occurs with a probability of the event occurring. This additional information helps in accelerating the mitigation process. The model is trained and tested using a real-world dataset.

Harnessing Artificial Intelligence Capabilities to Improve Cybersecurity

“…For example, in wind turbine generators, faults could be predicted by employing Artificial Neural Networks (ANNs) that monitor ambient temperature, generator speed, and pitch angle of the generator power outputs [166]. In controlling water systems, AI techniques such as k-NN, Decision Trees, and SVMs were employed to classify different anomaly events, including cyberattacks and hardware failures [167]. Furthermore, AI techniques such as SVMs and ANNs have been used to provide access control to SCADA systems based on users' dynamic attributes, such as location, time of use, and the user's work shift (when the user works onsite) [168].…”

Internet of Things for Sustainability: Perspectives in Privacy, Cybersecurity, and Future Trends

“…8. ) • The climate related threats on water [19,23,26,47,57,59,63,100,106] The waters systems security threats can be mitigated by water systems risk characterization, use of sustainable water IoT contamination monitoring and warning systems and through use of advanced machine learning systems for threat modeling [38,64]. Fig.…”

A Systematic Review of the State of Cyber-Security in Water Systems

“…Hindy et al [80] built a water system testbed composed of two water tanks, a PLC, a Modicon M238 logic controller, pumps and five sensors that measures various water levels and the presence of water in the tanks. The testbed has two mode of operation, simulating water distribution, and storage.…”

“…Classic machine learning algorithms are used to classify anomalous behaviour and affected components using the data gathered and reported by the PLCs. These algorithms are logistic regression, Gaussian naive Bayes, k-nearest neighbors (K-NN), support vector machine (SVM), decision trees and random forests [80]. They report that the K-NN model achieved the highest accuracy.…”